What Firmus does

Firmus is a Malaysia-headquartered cybersecurity services firm founded in 2008, with operations spanning Kuala Lumpur and Singapore (via FIRMUS PTE LTD, established 2023). The company provides a portfolio of offensive and defensive security services including penetration testing, red and purple teaming, managed detection and response (MDR), vulnerability management services (VMS), exposure management services (EMS), breach and attack simulation (BAS), and operational technology (OT) security testing. It also runs specialized offerings such as phishing simulation and Cyber Threat Intelligence (CTI). The firm serves enterprise, government, and financial-sector clients across Malaysia and Singapore, with named exposure to financial services, insurance, healthcare, business process outsourcing (BPO), and higher education verticals.

Firmus operates a services-led delivery model rather than a product-software model, monetizing primarily through project-based consulting engagements, retainer-based managed security services (e.g., the Centurion Managed Security Services Platform), and subscription-style platform subscriptions such as PhishDeck. The company is CREST-certified and ISO 27001:2022 certified, signals it actively uses in commercial positioning, and maintains a CREST-qualified testing bench including OSCP, OSCE, CRTP, and CEH-certified consultants. Technology stack dependencies include partnerships with established cybersecurity vendors (e.g., Semperis for Active Directory security), and the firm has been recognized regionally through the ASOCIO ICT Award (November 2023).

In October 2024, Firmus was acquired by TechMatrix Corporation (TSE: 3762), a Japanese IT services company. The deal positions Firmus as TechMatrix's Southeast Asian cybersecurity delivery arm and provides Firmus with capital, cross-border delivery capability, and access to Japanese enterprise clients. The leadership team — CEO Datuk Alan See, COO Eric Yeow, and CTO Maneesh Chandra — has been retained, suggesting continuity of operating model under new corporate ownership. Headcount is reported in the 101–250 range.

Name

Firmus

Legal name

FIRMUS PTE LTD

Website

https://firmussec.com

Company type

Private

Founded year

2008

Operating status

Operating

Headcount range

101–250 employees

Short description

Firmus is a Malaysia- and Singapore-based CREST-certified cybersecurity services firm founded in 2008, offering penetration testing, MDR, vulnerability management, and OT security to enterprise, government, and financial-sector clients, now operating as a TechMatrix Corporation subsidiary following its October 2024 acquisition.

Ownership category

akta.pro rank

Product category

Cybersecurity Services

NAICS

Security Systems Services (except Locksmiths) (561621), Testing Laboratories and Services (54138)

SIC

Services-Computer Programming, Data Processing, Etc. (7370), Services-Testing Laboratories (8734)

akta.pro primary industry

Security Operations Center (SOC) as a Service (BPAEADAB)

Keywords

• Penetration testing services
• Cybersecurity consulting
• Managed detection response
• Vulnerability assessment
• Incident response

Headquarters

HQ city

Kuala Lumpur

HQ country

Malaysia

HQ region

Asia

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. Professional Security Services: Revenue generated from penetration testing services, security assessments, red teaming, incident response, digital forensics, and security configuration reviews. Services are delivered by certified security consultants holding industry certifications including SANS/GIAC GPEN, GWAPT, GCIH, OSCP, CEH, CISSP, CISA, CRPT, CPSA.
2. Managed Security Services: Recurring revenue from Centurion Managed Services including Managed Detection & Response (MDR) 24/7 threat monitoring, Vulnerability Management (VMS), and Exposure & Digital Risk Management (EMS). Provides continuous security monitoring and support.
3. Security Consulting and Compliance: ISMS ISO 27001 consultancy services, enterprise security strategy, business continuity planning, DLP consulting, and security policy development. Includes compliance assessments and gap analysis.
4. Security Awareness Training: Security awareness campaigns, cyber risk awareness programs, and cyber drills for organizational employees.

Go-to-market motion1 record

Distribution channels3 records

Marketing channels5 records

Core offering

Firmus is a CREST-certified cybersecurity services provider specializing in penetration testing, managed security, operational technology security, and assurance services. The company delivers network, web application, mobile, IoT, and red team penetration testing, alongside managed detection and response (MDR), breach and attack simulation, Active Directory security, ISO 27001 consultancy, and security awareness training for organizations across Asia.

Product overview

FIRMUS is a cybersecurity services company offering a comprehensive portfolio of security assessment and managed services. The core offering centers on CREST-certified penetration testing services utilizing a hybrid approach of automated and manual testing methods. The service portfolio spans: Assessment services (penetration testing across network, web application, mobile, wireless, and social engineering vectors, plus Breach and Attack Simulation, Red Teaming, Incident Response, and Digital Forensics); Centurion Managed Services (Managed Detection & Response, Vulnerability Management, and Exposure & Digital Risk Management); Operational Technology Security; Assurance services including ISO 27001 consultancy and Security Policy development; and Security Awareness training programs. The company operates across Malaysia and Singapore with a focus on ASEAN enterprises.

Differentiator

Problem solved

Functional benefit

Brands

• Centurion Managed Services: Managed Detection & Response (MDR), Vulnerability Management (VMS), and Exposure & Digital Risk Management services

Products and services

• Pentest Services Umbrella penetration testing service line covering network, web application, mobile application, IoT device, red team, and source code review testing for enterprises that need to identify and remediate security vulnerabilities across their digital infrastructure.
• Centurion Managed Services

Named customers11 records

Segments6 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature4 records

Partnerships

Seven partnerships are on record, tiered core and minor.

• SemperiscoreTechnology or IntegrationStrategic partnership with Semperis, the leading provider of Active Directory security and recovery platforms. FIRMUS delivers advanced AD security solutions leveraging Semperis technology to fortify client defenses, reduce risks, and ensure uninterrupted IT operations.
• Picus SecuritycoreTechnology or IntegrationPartnership with Picus Security, the Pioneer of Breach and Attack Simulation, enables FIRMUS clients to have a more holistic view of their security posture with consistent and continuous improvement of security systems through automated cyber security posture validation.
• CrowdStrikecoreTechnology or IntegrationFIRMUS met CrowdStrike's Engagement Licensing Program (ELP) partner requirements, trained and certified to leverage the CrowdStrike Falcon platform as part of service delivery for incident response and security assessments.
• CyberArkcoreTechnology or IntegrationLong-term partnership with CyberArk providing comprehensive identity security solutions. FIRMUS received Best Privileged Access Management (PAM) Win award at CyberArk Partner Identity Refresh 2022, recognizing successful PAM implementations with clients.
• FortinetcoreChannel Partner/ Reseller/ DistributorFortinet channel ecosystem partnership where FIRMUS joins forces with Fortinet to help businesses tackle complex cyber risks. FIRMUS is a channel partner helping accelerate Fortinet's go-to-market in delivering technologies and solutions.
• SEGi University & CollegesminorStrategic or Co-development PartnerMemorandum of Understanding (MoU) with SEGi University & Colleges to pave the way for collaboration in producing graduates to meet the increasing demand of the cybersecurity industry. Includes talent development and industry-academia partnership.
• PIKOMminorGTM or Marketing PartnerFIRMUS is an active member of PIKOM (National Tech Association of Malaysia) and plays a key role in raising awareness and advocating a safer cyberspace for the growth of the digital economy.

Scale indicators3 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• Trustwave: Global cybersecurity services firm providing managed detection & response, penetration testing, and consulting — comparable to FIRMUS's combined pentest-plus-managed-services model, but at a much larger scale.
• NCC Group: Global cybersecurity consulting and penetration testing firm with a broad service portfolio including NCC Group's CHECK/CREST-equivalent accreditations; a larger incumbent operating in the same pentesting and assurance space.
• Secureworks: Global MSSP offering managed detection & response, vulnerability management, and incident response — overlapping with FIRMUS's Centurion managed services portfolio at the enterprise level.
• Mandiant (Google Cloud): Global incident response, threat intelligence and cybersecurity consulting firm; comparable to FIRMUS's DFIR, red teaming, and intelligence-led pentesting services for enterprise clients.

Direct peers

• LGMS (LE Global Services): Malaysian cybersecurity services company providing penetration testing, compliance assessments, and managed security services across the same enterprise verticals as FIRMUS, including financial services and government.
• Bridewell Consulting: UK-based cybersecurity consultancy offering penetration testing, managed detection & response, and security consulting — directly comparable to FIRMUS's CREST-certified pentesting and Centurion managed services portfolio.
• TOC Security: Malaysia-based cybersecurity services company providing penetration testing, red teaming, and security assessments to Malaysian enterprises — directly comparable to FIRMUS's home-market pentest business.
• Quann (formerly e-Cop): Singapore-headquartered managed security services provider with SOC and cybersecurity consulting capabilities, serving enterprises across the same ASEAN markets FIRMUS targets.
• Horangi Cyber Security: Singapore-headquartered cybersecurity firm offering penetration testing, cloud security posture management, and managed detection & response to ASEAN enterprises — directly overlapping FIRMUS's service portfolio and geographic focus.
• Ensign InfoSecurity: Singapore-based cybersecurity services provider offering managed security, threat intel, and consulting to large ASEAN enterprises and governments — overlapping with FIRMUS's enterprise/government-focused MSSP model.

Market position

Strengths5 records

Weaknesses4 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

Compliance4 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles5 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Firmus